dnsmasq CVE-2026-93011

Exploitation requires dnsmasq to be built with DNSSEC support (not compiled in by default) AND DNSSEC validation to be enabled at runtime; without both, the vulnerable code path is absent. Given that, the attacker must be able to make dnsmasq validate a crafted DNSSEC response - i.e. return or spoof a malicious response for a signed name the resolver looks up (on-path/off-path DNS answer injection or an attacker-controlled authoritative zone). Limiting factors: the non-default DNSSEC configuration sharply reduces the exposed population, and the write is bounded to a few bytes of adjacent heap metadata, constraining impact. The input vector lists no user-interaction or authentication requirement (PR:N/UI:N).

The signals point to a genuine but moderate-priority issue rather than an emergency. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a remotely reachable, unauthenticated, low-complexity flaw whose only impact is a Low integrity hit - consistent with the description's 'few bytes past a name buffer' overwriting 'a small amount of adjacent heap metadata' (CWE-787, out-of-bounds write). The vuln.today Decision label is 'this_month', i.e. a scheduled-remediation priority, not 'act_now'/'emergency'. No CISA KEV listing, no EPSS score, and no POC/exploit reference are present in the input, so there is no public evidence of exploitation or working exploit code. The most important mitigating signal is NOT in the CVSS vector: the description states DNSSEC 'is not compiled in by default and must also be enabled at runtime,' so the AV:N/PR:N/AC:L vector materially overstates reach for default deployments - most dnsmasq instances are not exposed to this path. Note also a tension to verify with the vendor: an out-of-bounds write that corrupts heap metadata would typically carry some availability (crash) risk, yet the input vector sets A:N; the Red Hat scoring may reflect that only a few bytes are written. Overall: a real, patch-worthy memory-safety bug, but low real-world urgency given the non-default feature requirement and the absence of KEV/EPSS/POC evidence.

An operator runs dnsmasq built with DNSSEC and enables validation at runtime. A remote attacker who controls (or can spoof) DNS responses for a name the resolver queries returns a crafted DNSSEC response; when dnsmasq converts names to/from wire format during validation, it writes a few bytes past the internal name buffer and corrupts adjacent heap metadata. No public exploit code or PoC reference is present in the supplied data, and the practical impact is bounded by the small overwrite and the non-default DNSSEC requirement.